4 ms·

DV certificates are not meant to certify who operates a given site. They only certify that you are securely connected to the authorized server for the domain na

DV certificates are not meant to certify who operates a given site. They only certify that you are securely connected to the authorized server for the domain name, instead of being MITM-ed. So, in effect, CAs issuing DV certs for websites, including phishing sites, is a feature, not a bug. If users are misinterpreting what a DV certificate means and doesn't mean, then it is up to browsers to make clear the difference between DV, OV, and EV. A Domain-Validation certificate is just that. We shouldn't expect it to act like OV or EV.

GrinningFool 10y ago
We don't - but most of the rest of the browsing public doesn't know the difference.
- eridius 10y ago
  That's why it's up to the browser to distinguish them.
  - GrinningFool 10y ago
    The problem with that is that they haven't significantly done so yet - and people are well-trained to look for the green padlock to ensure the site is secure without much consideraton beyond that point. So while I see your point, that's another transition that will take years to drill into public awareness - even if the browsers could agree on a meaningful and consistent representation, which seems like its own challenge
    - eridius 10y ago
      Safari has. There's no green on the address bar for a DV cert, just a little grey padlock. But with an EV cert you get the green text and the legal name (in addition to the domain). So that makes it easy - if there's green, you can trust it to tell you the legal entity that you're talking to.